The version format with dots is the one matched by CPE. This way it is not necessary to override with <PKG>_CVE_VERSION. The dotted variant is also better suited in SBOM for later use in CVE scanning tools. Bonus: the changed download URL has less HTTP redirects.
Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost Signed-off-by: Alexander Dahl <[email protected]> --- Notes: v2: - set version to the dotted variant and use subst on the filename instead - extended commit message rules/boost.make | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/rules/boost.make b/rules/boost.make index a3b453efb..013351972 100644 --- a/rules/boost.make +++ b/rules/boost.make @@ -15,15 +15,16 @@ PACKAGES-$(PTXCONF_BOOST) += boost # # Paths and names # -BOOST_VERSION := 1_89_0 +BOOST_VERSION := 1.89.0 BOOST_SHA256 := 85a33fa22621b4f314f8e85e1a5e2a9363d22e4f4992925d4bb3bc631b5a0c7a -BOOST := boost_$(BOOST_VERSION) +BOOST := boost_$(subst .,_,$(BOOST_VERSION)) BOOST_SUFFIX := tar.bz2 -BOOST_URL := $(call ptx/mirror, SF, boost/$(BOOST).$(BOOST_SUFFIX)) +BOOST_URL := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX)) BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX) BOOST_DIR := $(BUILDDIR)/$(BOOST) BOOST_LICENSE := BSL-1.0 BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c +BOOST_CVE_PRODUCT := boost:boost # ---------------------------------------------------------------------------- # Prepare -- 2.47.3
